Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale
Essential information
- Published
- 04/03/2026 19:42
- Modified
- 05/03/2026 09:48
- Tags
- 2026-03-04 adversary-in-the-middle credential-theft evasion techniques multifactor authentication bypass phishing-as-a-service session token interception tycoon2fa
- Related entities
- 9 observables, 1 intrusion sets (apt), 17 techniques (mitre), 1 malware, 13 others
Description
Tycoon2FA emerged as a prominent phishing-as-a-service platform in August 2023, enabling large-scale campaigns targeting over 500,000 organizations monthly. Developed by Storm-1747, it provided adversary-in-the-middle capabilities to bypass multifactor authentication. The kit allowed impersonation of trusted brands like Microsoft 365 and Gmail, intercepting session cookies and credentials. It employed sophisticated evasion techniques including anti-bot screening, browser fingerprinting, and custom CAPTCHAs. Tycoon2FA's infrastructure evolved to use diverse, short-lived domains and complex redirect chains. Its success stemmed from closely mimicking legitimate authentication processes while covertly intercepting user credentials and session tokens.